334 	} karg;  in do_video_ioctl()  local
354 		err = get_video_tuner32(&karg.vt, up);  in do_video_ioctl()
358 		err = get_video_window32(&karg.vw, up);  in do_video_ioctl()
362 		err = get_video_buffer32(&karg.vb, up);  in do_video_ioctl()
366 		err = get_user(karg.vx, (u32 *)up);  in do_video_ioctl()
373 	err = sys_ioctl(fd, cmd, (unsigned long)&karg);  in do_video_ioctl()
377 		free_kvideo_clips(&karg.vw);  in do_video_ioctl()
382 			err = put_video_tuner32(&karg.vt, up);  in do_video_ioctl()
386 			err = put_video_window32(&karg.vw, up);  in do_video_ioctl()
390 			err = put_video_buffer32(&karg.vb, up);  in do_video_ioctl()
394 			err = put_user(((u32)karg.vx), (u32 *)up);  in do_video_ioctl()
1074 	void *karg = NULL;  in fd_ioctl_trans()  local
1093 			f = karg = kmalloc(sizeof(struct floppy_struct), GFP_KERNEL);  in fd_ioctl_trans()
1094 			if (!karg)  in fd_ioctl_trans()
1119 			f = karg = kmalloc(sizeof(struct floppy_drive_params), GFP_KERNEL);  in fd_ioctl_trans()
1120 			if (!karg)  in fd_ioctl_trans()
1151 			karg = kmalloc(sizeof(struct floppy_drive_struct), GFP_KERNEL);  in fd_ioctl_trans()
1152 			if (!karg)  in fd_ioctl_trans()
1156 			karg = kmalloc(sizeof(struct floppy_fdc_state), GFP_KERNEL);  in fd_ioctl_trans()
1157 			if (!karg)  in fd_ioctl_trans()
1161 			karg = kmalloc(sizeof(struct floppy_write_errors), GFP_KERNEL);  in fd_ioctl_trans()
1162 			if (!karg)  in fd_ioctl_trans()
1169 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in fd_ioctl_trans()
1176 			struct floppy_struct *f = karg;  in fd_ioctl_trans()
1192 			struct floppy_drive_params *f = karg;  in fd_ioctl_trans()
1218 			struct floppy_drive_struct *f = karg;  in fd_ioctl_trans()
1239 			struct floppy_fdc_state *f = karg;  in fd_ioctl_trans()
1256 			struct floppy_write_errors *f = karg;  in fd_ioctl_trans()
1272 out:	if (karg) kfree(karg);  in fd_ioctl_trans()
1497 	void *karg;  in ppp_ioctl_trans()  local
1503 		karg = &idle;  in ppp_ioctl_trans()
1520 		karg = &data;  in ppp_ioctl_trans()
1533 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in ppp_ioctl_trans()
1601 	void *karg;  in mt_ioctl_trans()  local
1607 		karg = &pos;  in mt_ioctl_trans()
1611 		karg = &get;  in mt_ioctl_trans()
1615 		karg = &info;  in mt_ioctl_trans()
1619 		karg = &info;  in mt_ioctl_trans()
1643 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in mt_ioctl_trans()
1700 	void *karg;  in cdrom_ioctl_trans()  local
1705 		karg = &cdreadaudio;  in cdrom_ioctl_trans()
1717 		karg = &cgc;  in cdrom_ioctl_trans()
1738 	err = sys_ioctl (fd, cmd, (unsigned long)karg);  in cdrom_ioctl_trans()
2494 	void *karg = &u;  in do_lvm_ioctl()  local
2501 		karg = v;  in do_lvm_ioctl()
2520 		karg = v;  in do_lvm_ioctl()
2610 		karg = &p;  in do_lvm_ioctl()
2634         err = sys_ioctl (fd, cmd, (unsigned long)karg);  in do_lvm_ioctl()
2805 	drm_unique_t karg;  in drm32_getsetunique()  local
2811 	if (get_user(karg.unique_len, &uarg->unique_len))  in drm32_getsetunique()
2813 	karg.unique = NULL;  in drm32_getsetunique()
2821 		karg.unique = kmalloc(karg.unique_len, GFP_KERNEL);  in drm32_getsetunique()
2822 		if (!karg.unique)  in drm32_getsetunique()
2825 		    copy_from_user(karg.unique, uptr, karg.unique_len)) {  in drm32_getsetunique()
2826 			kfree(karg.unique);  in drm32_getsetunique()
2834 		ret = sys_ioctl (fd, DRM_IOCTL_GET_UNIQUE, (unsigned long)&karg);  in drm32_getsetunique()
2836 		ret = sys_ioctl (fd, DRM_IOCTL_SET_UNIQUE, (unsigned long)&karg);  in drm32_getsetunique()
2842 		    copy_to_user(uptr, karg.unique, karg.unique_len))  in drm32_getsetunique()
2844 		if (put_user(karg.unique_len, &uarg->unique_len))  in drm32_getsetunique()
2848 	if (karg.unique != NULL)  in drm32_getsetunique()
2849 		kfree(karg.unique);  in drm32_getsetunique()
2869 	drm_map_t karg;  in drm32_addmap()  local
2874 	ret  = get_user(karg.offset, &uarg->offset);  in drm32_addmap()
2875 	ret |= get_user(karg.size, &uarg->size);  in drm32_addmap()
2876 	ret |= get_user(karg.type, &uarg->type);  in drm32_addmap()
2877 	ret |= get_user(karg.flags, &uarg->flags);  in drm32_addmap()
2879 	ret |= get_user(karg.mtrr, &uarg->mtrr);  in drm32_addmap()
2883 	karg.handle = (void *) A(tmp);  in drm32_addmap()
2887 	ret = sys_ioctl(fd, DRM_IOCTL_ADD_MAP, (unsigned long) &karg);  in drm32_addmap()
2891 		ret  = put_user(karg.offset, &uarg->offset);  in drm32_addmap()
2892 		ret |= put_user(karg.size, &uarg->size);  in drm32_addmap()
2893 		ret |= put_user(karg.type, &uarg->type);  in drm32_addmap()
2894 		ret |= put_user(karg.flags, &uarg->flags);  in drm32_addmap()
2895 		tmp = (u32) (long)karg.handle;  in drm32_addmap()
2897 		ret |= put_user(karg.mtrr, &uarg->mtrr);  in drm32_addmap()
2915 	drm_buf_info_t karg;  in drm32_info_bufs()  local
2920 	if (get_user(karg.count, &uarg->count) ||  in drm32_info_bufs()
2926 	orig_count = karg.count;  in drm32_info_bufs()
2928 	karg.list = kmalloc(karg.count * sizeof(drm_buf_desc_t), GFP_KERNEL);  in drm32_info_bufs()
2929 	if (!karg.list)  in drm32_info_bufs()
2934 	ret = sys_ioctl(fd, DRM_IOCTL_INFO_BUFS, (unsigned long) &karg);  in drm32_info_bufs()
2938 		if (karg.count <= orig_count &&  in drm32_info_bufs()
2939 		    (copy_to_user(ulist, karg.list,  in drm32_info_bufs()
2940 				  karg.count * sizeof(drm_buf_desc_t))))  in drm32_info_bufs()
2942 		if (put_user(karg.count, &uarg->count))  in drm32_info_bufs()
2946 	kfree(karg.list);  in drm32_info_bufs()
2960 	drm_buf_free_t karg;  in drm32_free_bufs()  local
2966 	if (get_user(karg.count, &uarg->count) ||  in drm32_free_bufs()
2972 	karg.list = kmalloc(karg.count * sizeof(int), GFP_KERNEL);  in drm32_free_bufs()
2973 	if (!karg.list)  in drm32_free_bufs()
2977 	if (copy_from_user(karg.list, ulist, (karg.count * sizeof(int))))  in drm32_free_bufs()
2982 	ret = sys_ioctl(fd, DRM_IOCTL_FREE_BUFS, (unsigned long) &karg);  in drm32_free_bufs()
2986 	kfree(karg.list);  in drm32_free_bufs()
3009 	drm_buf_map_t karg;  in drm32_map_bufs()  local
3014 	if (get_user(karg.count, &uarg->count) ||  in drm32_map_bufs()
3019 	karg.virtual = (void *) A(tmp1);  in drm32_map_bufs()
3022 	orig_count = karg.count;  in drm32_map_bufs()
3024 	karg.list = kmalloc(karg.count * sizeof(drm_buf_pub_t), GFP_KERNEL);  in drm32_map_bufs()
3025 	if (!karg.list)  in drm32_map_bufs()
3029 	for (i = 0; i < karg.count; i++) {  in drm32_map_bufs()
3030 		if (get_user(karg.list[i].idx, &ulist[i].idx) ||  in drm32_map_bufs()
3031 		    get_user(karg.list[i].total, &ulist[i].total) ||  in drm32_map_bufs()
3032 		    get_user(karg.list[i].used, &ulist[i].used) ||  in drm32_map_bufs()
3036 		karg.list[i].address = (void *) A(tmp1);  in drm32_map_bufs()
3041 	ret = sys_ioctl(fd, DRM_IOCTL_MAP_BUFS, (unsigned long) &karg);  in drm32_map_bufs()
3046 			tmp1 = (u32) (long) karg.list[i].address;  in drm32_map_bufs()
3047 			if (put_user(karg.list[i].idx, &ulist[i].idx) ||  in drm32_map_bufs()
3048 			    put_user(karg.list[i].total, &ulist[i].total) ||  in drm32_map_bufs()
3049 			    put_user(karg.list[i].used, &ulist[i].used) ||  in drm32_map_bufs()
3055 		if (put_user(karg.count, &uarg->count))  in drm32_map_bufs()
3060 	kfree(karg.list);  in drm32_map_bufs()
3088 	drm_dma_t karg;  in drm32_dma()  local
3093 	karg.send_indices = karg.send_sizes = NULL;  in drm32_dma()
3094 	karg.request_indices = karg.request_sizes = NULL;  in drm32_dma()
3096 	if (get_user(karg.context, &uarg->context) ||  in drm32_dma()
3097 	    get_user(karg.send_count, &uarg->send_count) ||  in drm32_dma()
3100 	    get_user(karg.flags, &uarg->flags) ||  in drm32_dma()
3101 	    get_user(karg.request_count, &uarg->request_count) ||  in drm32_dma()
3102 	    get_user(karg.request_size, &uarg->request_size) ||  in drm32_dma()
3105 	    get_user(karg.granted_count, &uarg->granted_count))  in drm32_dma()
3113 	if (karg.send_count) {  in drm32_dma()
3114 		karg.send_indices = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
3115 		karg.send_sizes = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
3118 		if (!karg.send_indices || !karg.send_sizes)  in drm32_dma()
3122 		if (copy_from_user(karg.send_indices, u_si,  in drm32_dma()
3123 				   (karg.send_count * sizeof(int))) ||  in drm32_dma()
3124 		    copy_from_user(karg.send_sizes, u_ss,  in drm32_dma()
3125 				   (karg.send_count * sizeof(int))))  in drm32_dma()
3129 	if (karg.request_count) {  in drm32_dma()
3130 		karg.request_indices = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
3131 		karg.request_sizes = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
3134 		if (!karg.request_indices || !karg.request_sizes)  in drm32_dma()
3138 		if (copy_from_user(karg.request_indices, u_ri,  in drm32_dma()
3139 				   (karg.request_count * sizeof(int))) ||  in drm32_dma()
3140 		    copy_from_user(karg.request_sizes, u_rs,  in drm32_dma()
3141 				   (karg.request_count * sizeof(int))))  in drm32_dma()
3147 	ret = sys_ioctl(fd, DRM_IOCTL_DMA, (unsigned long) &karg);  in drm32_dma()
3151 		if (put_user(karg.context, &uarg->context) ||  in drm32_dma()
3152 		    put_user(karg.send_count, &uarg->send_count) ||  in drm32_dma()
3153 		    put_user(karg.flags, &uarg->flags) ||  in drm32_dma()
3154 		    put_user(karg.request_count, &uarg->request_count) ||  in drm32_dma()
3155 		    put_user(karg.request_size, &uarg->request_size) ||  in drm32_dma()
3156 		    put_user(karg.granted_count, &uarg->granted_count))  in drm32_dma()
3159 		if (karg.send_count) {  in drm32_dma()
3160 			if (copy_to_user(u_si, karg.send_indices,  in drm32_dma()
3161 					 (karg.send_count * sizeof(int))) ||  in drm32_dma()
3162 			    copy_to_user(u_ss, karg.send_sizes,  in drm32_dma()
3163 					 (karg.send_count * sizeof(int))))  in drm32_dma()
3166 		if (karg.request_count) {  in drm32_dma()
3167 			if (copy_to_user(u_ri, karg.request_indices,  in drm32_dma()
3168 					 (karg.request_count * sizeof(int))) ||  in drm32_dma()
3169 			    copy_to_user(u_rs, karg.request_sizes,  in drm32_dma()
3170 					 (karg.request_count * sizeof(int))))  in drm32_dma()
3176 	if (karg.send_indices)  in drm32_dma()
3177 		kfree(karg.send_indices);  in drm32_dma()
3178 	if (karg.send_sizes)  in drm32_dma()
3179 		kfree(karg.send_sizes);  in drm32_dma()
3180 	if (karg.request_indices)  in drm32_dma()
3181 		kfree(karg.request_indices);  in drm32_dma()
3182 	if (karg.request_sizes)  in drm32_dma()
3183 		kfree(karg.request_sizes);  in drm32_dma()
3198 	drm_ctx_res_t karg;  in drm32_res_ctx()  local
3203 	karg.contexts = NULL;  in drm32_res_ctx()
3204 	if (get_user(karg.count, &uarg->count) ||  in drm32_res_ctx()
3210 	orig_count = karg.count;  in drm32_res_ctx()
3211 	if (karg.count && ulist) {  in drm32_res_ctx()
3212 		karg.contexts = kmalloc((karg.count * sizeof(drm_ctx_t)), GFP_KERNEL);  in drm32_res_ctx()
3213 		if (!karg.contexts)  in drm32_res_ctx()
3215 		if (copy_from_user(karg.contexts, ulist,  in drm32_res_ctx()
3216 				   (karg.count * sizeof(drm_ctx_t)))) {  in drm32_res_ctx()
3217 			kfree(karg.contexts);  in drm32_res_ctx()
3224 	ret = sys_ioctl(fd, DRM_IOCTL_RES_CTX, (unsigned long) &karg);  in drm32_res_ctx()
3229 			if (copy_to_user(ulist, karg.contexts,  in drm32_res_ctx()
3233 		if (put_user(karg.count, &uarg->count))  in drm32_res_ctx()
3237 	if (karg.contexts)  in drm32_res_ctx()
3238 		kfree(karg.contexts);  in drm32_res_ctx()
3691 	struct mtd_oob_buf		karg;  in mtd_rw_oob()  local
3695 	if (get_user(karg.start, &uarg->start) 		||  in mtd_rw_oob()
3696 	    get_user(karg.length, &uarg->length)	||  in mtd_rw_oob()
3700 	karg.ptr = A(tmp);  in mtd_rw_oob()
3701 	if (verify_area(VERIFY_WRITE, karg.ptr, karg.length))  in mtd_rw_oob()
3706 		ret = sys_ioctl(fd, MEMREADOOB, (unsigned long)&karg);  in mtd_rw_oob()
3708 		ret = sys_ioctl(fd, MEMWRITEOOB, (unsigned long)&karg);  in mtd_rw_oob()
3714 		ret = put_user(karg.start, &uarg->start);  in mtd_rw_oob()
3715 		ret |= put_user(karg.length, &uarg->length);  in mtd_rw_oob()